GDPR & Data Protection

Stratum Audit Services LLP Last updated: November 2026

Stratum Audit Services LLP ("Stratum", "we", "us", "our") supports clients in the Global Business sector, investment holding structures, and international fund structures, which means we sometimes process personal data relating to individuals in the European Union / European Economic Area ("EU/EEA"). This page explains how we approach compliance with the EU General Data Protection Regulation (GDPR) and the Mauritius Data Protection Act 2017, in addition to the practices described in our Privacy Policy.

1. Our Role

Depending on the service, Stratum may act as:

a data controller — for example, in relation to personal data we collect directly through the Website, or as part of our own client and staff administration; or
a data processor — for example, where we process personal data (such as beneficial owner or investor information) on behalf of a client in the course of an audit, tax, accounting, or corporate services engagement, in accordance with that client's instructions.

The specific role, and the responsibilities that follow from it, is set out in the relevant engagement letter or data processing agreement with each client.

2. Legal Bases for Processing (GDPR Article 6)

Where GDPR applies, we rely on the following legal bases:

Contract — processing necessary to perform an engagement or provide services requested by a client.
Legal obligation — processing necessary to comply with legal, regulatory, or professional obligations, including AML/CFT, KYC, FATCA/CRS, and tax reporting requirements under Mauritian and, where relevant, foreign law.
Legitimate interests — processing necessary for our legitimate business interests, such as responding to enquiries, maintaining client relationships, and ensuring the security of our systems, provided this is not overridden by your interests or fundamental rights.
Consent — where we rely on your consent (for example, for certain marketing communications), you may withdraw that consent at any time.

3. Special Category Data

In the course of certain engagements (for example, AML/CFT due diligence or payroll processing), we may handle limited special category or sensitive data. Where this occurs, we apply additional safeguards and process such data only where permitted under applicable law and, where required, with appropriate consent or another valid legal basis.

4. International Data Transfers

Personal data processed by Stratum is primarily held and processed in Mauritius. Where personal data originating from the EU/EEA is transferred to or processed in Mauritius, or onward to other jurisdictions (for example, in connection with an international fund structure or group), we take steps to ensure the transfer is protected by appropriate safeguards, which may include:

Standard Contractual Clauses (SCCs) approved by the European Commission;
contractual data protection and confidentiality commitments with service providers and sub-processors;
assessing the data protection framework of the receiving jurisdiction.

5. Data Subject Rights

If GDPR applies to you, you have the following rights in relation to your personal data, subject to applicable exemptions:

Right of access — to obtain confirmation of, and access to, personal data we hold about you.
Right to rectification — to request correction of inaccurate or incomplete data.
Right to erasure — to request deletion of your personal data, subject to our legal, regulatory, and professional retention obligations (which, for audit and tax records, are often mandatory).
Right to restrict processing — to request that we limit how we use your data in certain circumstances.
Right to data portability — to receive certain data in a structured, commonly used, machine-readable format, where technically feasible.
Right to object — to object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent — where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal.
Right to lodge a complaint — with a supervisory authority, including the Data Protection Office of Mauritius or, where applicable, the data protection authority of your EU/EEA member state.

Because much of the personal data we process is tied to statutory audit, tax, and AML/CFT obligations, some rights (particularly erasure and objection) may be limited by law during and after the applicable retention period. We will explain any such limitation if it applies to your request.

6. How to Exercise Your Rights

To exercise any of the rights above, please contact us at:

Email: info@stratum.mu Phone: +230 57813655 Postal address: Level 12, Tower 1, Nexteracom, Rue du Savoir, Ebene, Cybercity, Mauritius

We may need to verify your identity before actioning a request, and will respond within the timeframes required under applicable law (generally one month under GDPR, extendable in complex cases).

7. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, including to satisfy statutory audit, tax, and AML/CFT retention periods under Mauritian law and, where applicable, the requirements of any foreign regulator relevant to a client's structure.

8. Data Security and Breach Notification

We maintain technical and organisational measures designed to protect personal data against unauthorised access, loss, or disclosure, in line with our professional confidentiality obligations. In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the relevant supervisory authority and affected individuals in accordance with applicable law and within the required timeframes.

9. Sub-Processors and Service Providers

Where we engage third-party service providers (for example, for IT hosting or software) that process personal data on our behalf, we take reasonable steps to ensure those providers offer an appropriate level of data protection and are bound by confidentiality and data processing terms.

10. Relationship to Our Privacy Policy

This page supplements, and should be read together with, our general Privacy Policy, which describes in more detail the categories of personal data we collect and how we use them.

11. Contact / Data Protection Queries

For any GDPR or data protection query, including to exercise your rights or raise a concern, please contact:

Stratum Audit Services LLP Level 12, Tower 1, Nexteracom, Rue du Savoir, Ebene, Cybercity, Mauritius Email: info@stratum.mu Phone: +230 57813655